Multiple U.S. defense contractors
July 1, 2024
•[ espionage, malware, government ]
Between July 2024 and July 2025, the Chinese state-linked group RedNovember, operating under the Ministry of State Security (MSS), conducted an espionage campaign exploiting internet-facing network devices and Outlook Web Access systems to infiltrate at least two U.S. defense contractors. Attackers deployed the Go-based backdoor Pantegana, Cobalt Strike, and SparkRAT for reconnaissance and persistence, exfiltrating sensitive defense-related data.
Harbor Behavioral Health
July 25, 2025
•[ leak, healthcare ]
Harbor reported that suspicious activity was identified on Aug 1, 2025; investigation determined an unauthorized party accessed and took files from the network between late July and Aug 1. Notifications were issued Sept 30; no encryption or operational disruption reported.
Undisclosed Italian Government Department (via Libraesva ESG vulnerability)
September 27, 2025
•[ hack, government ]
Libraesva confirmed that a zero-day vulnerability in its Email Security Gateway (ESG) was exploited beginning September 27 2025 by state-sponsored hackers to access one Italian government departments email system. The company released an emergency patch and reported no encryption or broader impact.
Harrods (via third-party service provider)
September 20, 2025
•[ leak, retail ]
The luxury retailer Harrods disclosed that a third-party service provider was compromised, leading to exposure of roughly 430,000 customer records. The company confirmed no encryption, ransom activity, or service disruption occurred.
Crimean Occupation Authorities / Government of Crimea
September 20, 2025
•[ hack, leak, government ]
Ukraines Defense Intelligence Directorate (GUR) announced it breached servers of the Russian-installed authorities in occupied Crimea, exfiltrating over 100 TB of official records. No encryption or service disruption reported.
Motility Software Solutions
August 19, 2025
•[ ransomware, malware, technology ]
Motility Software Solutions detected suspicious activity on Aug 19 2025 and confirmed ransomware deployment and data theft impacting about 760,000 individuals. Stolen data included names, birthdates, drivers license numbers, and SSNs. No threat actor attribution was disclosed.
ApolloMD (Business Associate to 11 Physician Practices)
May 22, 2025
•[ ransomware, malware, healthcare ]
ApolloMD confirmed unauthorized access to its network on May 2223 2025 affecting 11 affiliated physician practices. The Qilin ransomware group claimed to have stolen approximately 238 GB of data, including patient and insurance information. ApolloMD did not confirm encryption or ransom payment.
Kido International (London Nurseries)
September 10, 2025
•[ ransomware, education ]
Ransomware group Radiant claimed intrusion into Kido Internationals London nursery network in early September 2025, stealing data on over 8,000 children. The group leaked samples and demanded ransom. Kido confirmed the breach in late September but reported no encryption or operational disruption.
RemoteCOM (SCOUT Monitoring Software)
September 26, 2025
•[ leak, technology ]
DataBreaches.net reported that RemoteCOM, developer of the SCOUT monitoring platform used by law enforcement, was breached in late September 2025. Attackers exfiltrated data on approximately 6,900 officers and 14,000 monitored clients. No encryption or operational disruption was reported.
Circle K Hong Kong (Alimentation Couche-Tard)
September 21, 2025
•[ hack, retail ]
Circle K Hong Kong experienced a network disruption beginning September 21 2025 that partially halted e-payment and loyalty systems across approximately 400 stores. The company described it as a suspected cyberattack. No data encryption or data theft was reported.
Boyd Gaming Corporation
August 25, 2025
•[ hack ]
Boyd Gaming reported that it detected unauthorized access to internal application servers in late August 2025. No ransomware group or actor has claimed responsibility. The company disclosed the breach publicly on September 24 2025, noting no encryption or operational disruption and no figure released for records affected.
Maryland Transit Administration (MDOT)
August 26, 2025
•[ ransomware, malware, government ]
Attack by Rhysida ransomware group disrupted Maryland Transit Administrations MobilityLink systems and exfiltrated internal and personal data. Group demanded 30 BTC ransom.
Asahi Group (Japan operations)
September 29, 2025
•[ ransomware, malware, manufacturing ]
A ransomware attack disrupted Asahi Groups Japanese operations, fully halting order processing, shipping logistics, and customer service systems nationwide. Beer production stopped at six domestic plants for about a week, and only partial restoration was achieved by October 6 2025. Asahi confirmed the attack targeted internal servers but reported no confirmed data exfiltration or actor attribution.
Union County (Ohio) government / county systems
May 18, 2025
•[ ransomware, malware, government ]
A ransomware attack on Union County, Ohios public administration systems led to both encryption and data exfiltration. Data was stolen from internal government databases containing personal, financial, and biometric records of 45,487 individuals. Approximately 12 systems were encrypted, causing partial disruption for several days. No ransomware group has claimed responsibility.
Moldova Central Electoral Commission / election infrastructure
September 27, 2025
•[ hack, ddos, government ]
During Moldovas 2025 parliamentary election, distributed denial-of-service (DDoS) attacks targeted the Central Electoral Commissions public websites, briefly disrupting access for several hours with peaks around 400 Gbps. Officials accused Russian-aligned actors of interference, but attribution remains unconfirmed. Voting systems were unaffected.
Undisclosed targets in Russian civil society
September 24, 2025
•[ hack, malware ]
Russia-linked APT COLDRIVER conducted a new ClickFix-style campaign delivering BAITSWITCH (DLL downloader) and SIMPLEFIX (PowerShell backdoor) against civil-society targets; technique involves fake CAPTCHA/checkbox leading to command execution and C2 beacons.
Stellantis / Jeep / Dodge (via third-party service provider)
September 21, 2025
•[ hack, manufacturing ]
Stellantis confirmed a breach of a third-party vendors platform supporting its North American customer services. Attackers claimed Salesforce was the compromised system and alleged theft of 18 million records, but Stellantis has not confirmed this. Only contact information was reportedly exposed, and no financial or sensitive personal data was accessed.
Comcast Corporation
September 29, 2025
•[ ransomware, malware, technology ]
Medusa ransomware group claimed theft of 834.4 GB (167,121 files) from Comcast, including internal actuarial, claims, and modeling information. Attackers demanded USD 1.2 million to delete or release data; no encryption or operational disruption reported.
Office of the Deputy Chief Minister of Maharashtra
September 21, 2025
•[ hack, government ]
Maharashtra Deputy Chief Minister Eknak Shinde's ex-account was recently hacked during the high-voltage India-Pakistan-Asia Cup match. Hackers posted images of Pakistan and Turkey flags, sparking concern. However, thanks to the swift action of Shinde's social media team, the account was restored within 30-45 minutes and no sensitive data was compromised. The cybercrime police were immediately alerted and investigation is underway to determine the cause of the breach. This incident highlights the...
Gloucester-Mathews Gazette-Journal
September 15, 2025
•[ ransomware, malware, technology ]
Ransomware hit the Gazette-Journals production file server over the weekend; discovered 09/15/2025; no customer financial data compromised; recovery allowed in-house printing to resume after network restoration; attacker unknown.
